Soatok Dreamseeker

Suppose, hypothetically, you discovered a 0-click RCE in Omarchy. What would be the maximally funny thing to do with this knowledge? ("Never disclose it to DHH" being table-stakes.)

If you've ever felt a sense of "wow some of these AI enthusiasts are kind of cult-like" you've probably seen the effects of them.

Judging from how folks talk about a fur that passed away recently, as heartwrenchingly sad as that is, it's also a little inspiring. If one could touch even a hundredth the number of lives he did, in such a positive and uplifting way? Then you're doing incredibly goddamn good.

Seeing Werner Koch's lame response on oss-sec is absolutely confirming my suspicions about the GnuPG team

Every time the Red Cross declares a different level of alarm over blood shortages, my gay ass who is excluded from donating blood is like "Hmm, do I want to abstain from gay sex for a full calendar year in order to help fix a problem for a system that discriminates against people like me?" and then I shrug.

Since the EU has made Chat Control 1.0 a thing, I should remind everyone that even having a plaintext mode at all is gross negligence for an E2EE system https://www.patrick-breyer.de/en/eu-parliament-greenlights-chat-control-1-0-breyer-our-children-lose-out/

Am I annoying?

Vaguely incorrectly remembering the time when @sophieschmieg@infosec.exchange : "The empty string is the prefix to all strings" People doing domain separation wrong:

@da_667@infosec.exchange Meanwhile every one of them is like "What do you mean you can't afford to run a GPU cluster 24/7 to test your self-hosted models on? You're too poor to even talk to me"

@da_667@infosec.exchange One of these days a tech bro is going to call me "not even human" and I'm going to drop the furry copypasta on that bitch

@da_667@infosec.exchange Hell yeah :3

RE: https://furry.engineer/@soatok/116925912306713260 I made a rather important update to this post for folks who hadn't been chewing on the threat model of E2EE for the past 4+ years. https://soatok.blog/2026/07/15/the-long-tail-of-work-left-until-activitypub-has-e2ee/#public-key-profile

Had a dream I was talking to someone and they told me their middle name was "Sunday" but they were thinking of changing it to "Bureaucratic Friday" I woke up trying to figure out which way they intended the joke

What projects are those? https://soatok.blog/2025/10/15/the-dreamseekers-vision-of-tomorrow/

Amazon can't help themselves when it comes to including "Simple" and "Managed" in a new service name because, looking at their warehouses, the upper management is clearly into S&M.

@mattblaze@federate.social I dunno about everyone else, but I plan to be walking around in fursuit!

The prevalence of spaghetti code in core infrastructure is clearly a homage to the Church of the Flying Spaghetti Monster.

I get some weird emails. How do I break it to them that "Barkane Arts" is a joke organization name that I came up with as a play on the term "computer wizardry" (but with more furry) rather than an LLC registered in any state?

I suspect someone's using an LLM to scrape all of my writing whenever I see anomalies like this.

I've emailed IANA requesting it be added to the registry alongside the RFC9421 algorithns. As Mastodon and other platforms onboard to RFC 9421, the availability of an interoperable specification should allow them to prioritize ML-DSA over, e.g., RSA.

I had to repost this manually because the WordPress.com / Jetpack social plugin didn't include the hecking preview image >.<

Context: https://geekfeminism.fandom.com/wiki/Jacob_Appelbaum_rape_reporthttps://medium.com/@hdevalence/when-hell-kept-on-payroll-somewhere-is-where-you-are-f419d3022d0

@gravepapaya@tiggi.es I'm on PrEP lol

@tmaher@infosec.exchange X.680 5.7 discusses recursion

@m0nad@infosec.exchange "Would you like CVEs with your McSlop?"

@cliffle@hachyderm.io Alan Turing appreciation is the gay option Alan Turing fanfiction is the gayer option Neither precludes "Yes" or "No"

Me, months ago: "Wow, there's nothing I feel like writing about. Work is extremely busy. I'll put it off." Me, now: "Wow, there are so many things to write about that it's hard to choose which one to finish first. Work is extremely busy. I'll put it off."

@womble@infosec.exchange @securingdev@infosec.exchange sashimi then?

@azonenberg@ioc.exchange @hazelnoot@enby.life Browser extensions are your only secure option if you want to use a "web frontend".

The Long Tail of Work Left Until ActivityPub Has E2EE Separate from my proposal for key transparency for the Fediverse (which I've certainly blogged about a lot), the W3C has been…... http://soatok.blog/2026/07/15/the-long-tail-of-work-left-until-activitypub-has-e2ee/

@theorangetheme@en.osm.town I'm on PrEP. I'm tested for HIV quarterly (which is required, along with a non-reactive test result, to continue receiving PrEP).

@ww@xyzzy.link @hazelnoot@enby.life @azonenberg@ioc.exchange An extension would be secure against any instance being compromised unless the author of the extension is also compromised. If furry.engineer got pwned after this is all rolled out, there's nothing I could do to stop JS served from furry.engineer from stealing my private keys, etc. However, a browser extension that does all the encryption, signing, and key management outside of the Fediverse domain's DOM entirely would be impervious to malicious JS. The downside is, as you say, the extension authors could also be compromised. But at least now we're talking about "the evil government needs to push malware onto the endpoint" rather than "passively just snoop on what the server receives for years". The cost of the attack is much, much higher. (Also, y'know, binary transparency, reproducible builds, and open source software can help!) https://defuse.ca/triangle-of-secure-code-delivery.htm cc @DefuseSec@infosec.exchange

@hazelnoot@enby.life This was prompted by https://pawb.social/post/47167667/23257426 lol

Since the poll is closed: The consensus is "No". Which is also what I believe. Happy to be proven wrong, of course.